Bug 870496 - Purge moved objects in the NewObjectCache on minor GC; r=billm

--HG--
extra : rebase_source : 8d4b7df4cff1df4f1fc1de88e823a3e7541a55df

js/src/gc/Nursery.cpp

@@ -492,6 +492,7 @@ js::Nursery::collect(JSRuntime *rt, JS::gcreason::Reason reason)
         comp->markAllInitialShapeTableEntries(&trc);
     }
     markStoreBuffer(&trc);
+    rt->newObjectCache.clearNurseryObjects(rt);
 
     /*
      * Most of the work is done here. This loop iterates over objects that have

js/src/jscntxt.h

@@ -338,6 +338,9 @@ class NewObjectCache
     NewObjectCache() { mozilla::PodZero(this); }
     void purge() { mozilla::PodZero(this); }
 
+    /* Remove any cached items keyed on moved objects. */
+    inline void clearNurseryObjects(JSRuntime *rt);
+
     /*
      * Get the entry index for the given lookup, return whether there was a hit
      * on an existing entry.

js/src/jscntxtinlines.h

@@ -29,6 +29,15 @@ NewObjectCache::staticAsserts()
     JS_STATIC_ASSERT(gc::FINALIZE_OBJECT_LAST == gc::FINALIZE_OBJECT16_BACKGROUND);
 }
 
+inline void
+NewObjectCache::clearNurseryObjects(JSRuntime *rt)
+{
+    for (unsigned i = 0; i < mozilla::ArrayLength(entries); ++i) {
+        if (IsInsideNursery(rt, entries[i].key))
+            mozilla::PodZero(&entries[i]);
+    }
+}
+
 inline bool
 NewObjectCache::lookup(Class *clasp, gc::Cell *key, gc::AllocKind kind, EntryIndex *pentry)
 {